Spying Internet Explorer 8.0

Your texte here ….

Spying on Internet
Explorer (Another inline hooking example)

28 September 2011

Brian MARIANI
Senior Security Consultant
ORIGINAL SWISS ETHICAL HACKING
©2011 High-Tech Bridge SA – www.htbridge.ch

cybercrime key points

 Your textethe major problems that exist today in
One of here ….
the internet is a whole underground
marketplace.

 Business ecosystem build around online
cybercrime.

 The online criminals invest too much money in
their targeted attacks.

 They are hiring programmers, testing people and
their skills to achieved their evil purposes.

 Criminals study security professional's habits,
to workaround the security defenses put in
place.

Is it enought?

 Your texte here ….
The CCIPS is the Computer Crime and
Intellectual Property Section.

 Is responsible for implementing the
Department's national strategies in
combating computer crimes worldwide.

 They prevents, investigates, and prosecutes
computer crimes.

 They work with other government agencies,
private sectors, academic institutions, and
foreign counterparts.

But… Today reality remains this



A recent cybercrime case



The threats

Malicious software also known as
“Malware” can compromise the security and
functionality of a computer.

 It can disrupt users privacy, damage
computer files, stealing identities, or
spontaneously opening unwanted internet
links.

 It can be also used in what we call “a zombie
army”, to mount distributed denial of service
attacks (DDOS).

 Once installed in a computer it monitors the
user‟s internet browsing habits.

Exploiting internet capabilities

 Your texte here …. use the global nature of
Cybercriminals
internet to take advantage.

 Internet is international, is a global system
of interconnected computer networks.

 So as soon as a bulletproof webserver is
taken down, the malware infrastructure
moves rapidly to another internet location.

 They profit of the non-existence of a well
organized international cybercrime police
that could prevent these kind of operations.

The worst banks enemy

 Your texte here …. the „second bank crisis‟, and
It‟s been called
this time the cause is a piece of malcode.

 it can steal millions from online bank
accounts with apparent impunity.

 It‟s name is Zeus or Zbot and it‟s really
clever.

 A gang of just nineteen persons have stolen
around 20 millions of pounds using it!


How easy it is to stole private information

 Your texte here …. case of Zeus Trojan, it uses inline
In the particular
hooking to take control over key components of
microsoft windows applications.

 We already covered what inline hooking is in the previous
article. Previous article

 In today example we are going to intercept and grab
trivial information from internet explorer.

 The example covers inline hooking without using
specifically a windows api, but a subroutine of
InternetConnectW exported from wininet.dll.

 The goal is to demonstrate that possibilities about inline
hooking are without limits if one take care of all the
details.

 As a test environment we used an english windows seven
distribution with internet explorer 8.0 version.


Practical example (1)

In this example we hook several wininet
functions without necessarily using them.

 The goal is to show how easy a massive api
hooking can be.

 The code can be modified to add more apis to
the ApiName array.

 It exists three main functions:

– PatchPreamble
– CalculateAndWriteJump
– CalculateAndWriteTrampoline



Functions declared with the naked attribute are
emitted without prolog or epilog code, enabling
you to write your own custom prolog/epilog
sequences using the inline assembler.

 since the naked directive is not available in dev-
cpp x86 the PatchPreamble function will rewrite
the hook function prolog with no operation (nop)
opcodes. We can later take care of our own
prolog if it‟s needed.



CalculateAndWriteJump will compute and
write the jump code from the hooked api to
our hook function, using the first 5 bytes.
We are not disassembling the code first but
assuming that we are dealing with a mov
edi,edi – push ebp – mov ebp,esp prolog.



 CalculateAndWriteTrampoline will write the trampoline 300 bytes
later from the patched prolog. since we calculate around 400
bytes for the hook function code, the gcc standard epilogue (POP
EBP – RETN) will never be hit.

 It exists an identifier named ToTrampolineBytes that can be
modified to add more space to inject our C or ASM code, but do
not forget to add more nops instructions into the hook function,
otherwise you will write out of borders.



This is the scenario once the Api is hooked. Example of
InternetConnectW.

1

3 2



 Your we said before , we are not going to leverage
As texte here ….
any wininet api but a subroutine of
InternetConnectW function.



 Your successfully hook this subroutine without
To texte here ….
hardcoding any address we:

 Add the number of bytes to reach the CALL Wininet.76845DCD to
the address of InternetConnectW.

 From this address we take the next four bytes skipping the 0xE8
opcode.

 Finally we add 5 more bytes.



Once the subroutine address is obtained we can
follow the aforementioned steps:

 PatchPreamble.

 CalculateAndWriteJump.

 CalculateAndWriteTrampoline.



The hooked subroutine calls IdnToAscii Api
exported from kernel32 module which
converts an internationalized domain name
(IDN) or another internationalized label to a
Unicode representation of the ASCII string
that represents the name in the Punycode
transfer encoding syntax.

 As we are interested in intercepting all
visited domain names we will grab each and
every accessed website in ascii format from a
stack buffer pointer.



 Your texte here …. browses the Internet, some
When the user
websites causes the change of the stack
ordering.

 This is a normal behavior as
InternetSetOptions API and others inter
modular calls could change the stack in
different ways.

 That‟s why it is important to analyse all the
different behaviours when we start to hook
windows internals procedures.



 Yourour example we will just put a condition
In texte here ….
to control a stack value.

 We analyse if from ebp register it exits the
nServerPort value of the precedent
InternetConnectW Api.

 This value can be 0x1BB or 0x50 which
correspond to SSL or not SSL connection.

 If this value exists we know that two dwords
upper we can find our pointer to the website
name.


we could implemented the example in other
“simpler ways”, but doing things always in a
easier and simpler way it‟s not always good
to learn.

 Some hook function code was written in ansi
C.

 other parts of code is injected as raw binary
code.

 So let‟s see how the code is implemented.



We test if the port connection value is 80 or 443. If
value is one of both we jump to 0x6ba011EC

If it‟s not we do nothing and we jump again into the
hooked subroutine after setting the stack correctly.

We save three pointers that will be overwritten with
fopen, fputs and fclose pointers.




We search the aforementioned pointers



Your texte here …. We push the path and filename, the append fopen
argument, and a carriage return character.

We open the file and grab the domain name, followed
by a carriage return, and we close the file handle.

We unstack arguments until we reach our saved
pointers.

We put the saved pointers at the same place they
were before.




We do nothing until we reach the trampoline

We set up the stack and we jump again into the
internetconnectw subroutine.



The implementation of the “raw binary code”
could be done in many different ways.

 We can always optimize the assembler code.

 It is very important to not overcharged the
application.

 If we add too much code the program
performance could suffer.

 Test the application to check if after the
code injection the program behaviour
remains the same.

Conclusions

 Your texte hereinformation
Stealing …. from well-known
windows application remains very easy.

 More dangerous scenarios will steal all the
information that the user send and receive,
including, passwords, credit card numbers,
and other sensitive data.

 Users must always protect themselves with
proactive applications that detect and stop
program injection on the fly.

 Do not rely only in “security programs” but
in a proactive audit of your systems.

Thank-you for reading


Thank-you for reading
Your questions are always welcome!
brian.mariani[at]htbridge.ch


References

 http://www.bbc.co.uk/news/technology-10865568
 http://www.darkreading.com/advanced-
threats/167901091/security/attacks-breaches/231500619/worm-
morphs-attacks-banks-with-zeus-like-features.html
 http://bits.blogs.nytimes.com/2009/08/20/how-hackers-snatch-real-time-
security-id-numbers
 http://money.cnn.com/2010/09/30/technology/cyber_crime_charges/index
.htm
 http://voices.washingtonpost.com/securityfix/2009/10/ubiquitous_zeus_
trojan_targets.html
 http://www.youtube.com/watch?v=cf3zxHuSM2Y
 http://news.techworld.com/security/3241594/police-arrest-gang-
behind-20-million-online-bank-fraud/
 http://www.cybercrime.gov/hackettPlea.pdf
 http://www.lemonde.fr/technologies/article/2010/10/01/etats-unis-les-
autorites-inculpent-60-personnes-pour-
cyberdelinquance_1418641_651865.html
 http://www.20minutos.es/noticia/830501/0/virus/telefonos/moviles/
 http://msdn.microsoft.com/en-us/library/dd318149%28v=vs.85%29.aspx
 http://blogs.techworld.com/war-on-error/2010/09/the-zeus-trojan-is-
stealing-money-with-impunity-can-it-be-stopped/index.htm

Spying Internet Explorer 8.0

Recomendados

Recomendados

Más contenido relacionado

Destacado

Destacado (16)

Similar a Spying Internet Explorer 8.0

Similar a Spying Internet Explorer 8.0 (20)

Último

Último (20)

Spying Internet Explorer 8.0